PT-2017-14023 · Luracast+1 · Luracast Restler+1

Published 2017-10-15 · Updated 2022-05-13 · CVE-2017-15363

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Luracast Restler versions through 3.0.0 restler extension for TYPO3 versions prior to 1.7.1

Description The issue allows remote attackers to read arbitrary files via the file parameter in the public/examples/resources/getsource.php file.

Recommendations For Luracast Restler versions through 3.0.0, consider restricting access to the getsource.php file until a patch is available. For restler extension for TYPO3 versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-15363

GHSA-RVMG-XC29-RVXF

Affected Products

Luracast Restler

Typo3

References · 7

• https://osv.dev/vulnerability/CVE-2017-15363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15363 · Security Note
• https://extensions.typo3.org/extension/restler · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rvmg-xc29-rvxf · Vendor Advisory
• https://extensions.typo3.org/extension/download/restler/1.7.1/zip · Vendor Advisory
• https://github.com/AOEpeople/TYPO3_Restler/releases/tag/1.7.1 · Note
• https://github.com/AOEpeople/TYPO3_Restler · Note